CVE-2026-13185
Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Remote Code Execution in Progress Telerik UI for AJAX

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: Progress Software Corporation

Description
In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-13185
EUVD
EUVD-2026-47690

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
progress telerik_ui_for_ajax to 2026.2.708 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Progress Telerik UI for AJAX versions before v2026.2.708. It involves insecure deserialization of attacker-controlled cookie content in RadPersistenceManager or RadDockLayout, enabling unauthenticated remote code execution.

Detection Guidance

Check if your system uses Progress Telerik UI for AJAX with versions prior to 2026.2.708. Inspect network traffic for suspicious cookie-based storage interactions in RadPersistenceManager or RadDockLayout.

Impact Analysis

An attacker could exploit this to execute arbitrary code on your server without authentication, potentially taking full control of the affected application or system.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements and HIPAA's security rules for protected health information.

Mitigation Strategies

Upgrade to Progress Telerik UI for AJAX version 2026.2.708 or later. Disable cookie-based storage in RadPersistenceManager and RadDockLayout if not required. Monitor for unauthorized code execution attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13185. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart